topic Using Time Modifiers in search for timechart in Splunk Search

Using Time Modifiers in search for timechart

jason_hotchkiss — Tue, 20 Jul 2021 14:25:47 GMT

Hello -

I was reading this: https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers

But it is not very clear to me how to use the time modifiers properly.

index=blah sourcetype=blah
fields _time index sourcetype GB
| timechart span=1d sum(GB) as Gigabytes

How would I draw my time chart to the end of the previous day over a 7-day period using a time modifier?

Would it be:

index=blah sourcetype=blah _index_earliest=-7d@d index_latest=-1d@d

Please advise, thank you.

Re: Using Time Modifiers in search for timechart

ITWhisperer — Tue, 20 Jul 2021 14:57:14 GMT

@d takes you to the beginning of the day so for end of previous day you need latest=@d i.e. beginning of current day.

Re: Using Time Modifiers in search for timechart

jason_hotchkiss — Tue, 20 Jul 2021 15:28:15 GMT

Ahh... I tried -@d - didn't occur to me to try @d. Thank you.